WordPress security by component

Total Upkeep

Plugin description

Total Upkeep is a WordPress component with 5 published CVE records in this archive. The latest tracked vulnerability was published Aug 06, 2026; the highest published CVSS base score is 8.2.

Plugin slug: boldgrid-backup

Latest vulnerability

CVE-2026-66708: Total Upkeep permits unauthenticated access to protected functionality

An unauthenticated visitor can reach a Total Upkeep operation that lacks the required authorization check in version 1.17.2 and earlier. The CNA does not disclose the endpoint or action, parameter, missing check, protected operation or exact impact.

PublishedAug 06, 2026

Known safe version1.17.3

Published vulnerabilities for boldgrid-backup
		Safe version
Aug 06, 2026	CVE-2026-66708 Total Upkeep permits unauthenticated access to protected functionality An unauthenticated visitor can reach a Total Upkeep operation that lacks the required authorization check in version 1.17.2 and earlier. The CNA does not disclose the endpoint or action, parameter, missing check, protected operation or exact impact.	1.17.3	CVE8.2 NVDPending
May 01, 2026	CVE-2026-3143 Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid: A security weakness Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 1.17.1.	> 1.17.1	CVE5.3 NVDPending
Feb 27, 2025	CVE-2024-13907 Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid: Server-side request forgery Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid is affected by server-side request forgery. Exploitation requires at least administrator-level access. The vulnerable server can be induced to make attacker-selected network requests.	See mitigation notes	CVE4.9 NVD6.5
Nov 26, 2024	CVE-2024-9461 Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid: Code execution Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid is affected by code execution. Exploitation requires at least administrator-level access. Successful exploitation can run attacker-controlled code in the WordPress hosting account.	See mitigation notes	CVE7.2 NVDPending
May 17, 2024	CVE-2024-24869 Total Upkeep: Filesystem traversal Total Upkeep is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.	See mitigation notes	CVE7.5 NVDPending

Data attribution: This product uses the NVD API but is not endorsed or certified by the NVD.

Vulnerability data licensing

CVE. Copyright © 1999–2026, The MITRE Corporation. MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

CWE. Copyright © 2006–2026, The MITRE Corporation. CWE™ is free to use by any organization or individual for any research, development, and/or commercial purposes, per these CWE Terms of Use. Accordingly, The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. Any copy you make for such purposes is authorized on the condition that you reproduce MITRE’s copyright designation and this license in any such copy.

CVSS. CVSS is owned and managed by FIRST.Org, Inc. (FIRST) and used by permission.

Source-record text is CVE/CNA content delivered through the NVD API. Fused summaries and remediation guidance are independently authored and are not attributed to NVD.

All other copyrights and trademarks are the property of their respective owners.

Full data sources, terms, and disclaimers